CVE-2024-40970

What it actually does

The dw-axi-dmac driver in the Linux kernel can overrun the hw_desc array inside axi_desc_put() when descs_allocated exceeds the pre-sized buffer (e.g., nr_buffers=3 with 3 segments each), because the structure did not track the actual number of allocated hardware descriptors.

Why it matters to the business

Linux systems using the AXI DMA controller experience kernel panics and abrupt reboots, producing unplanned downtime, potential data corruption, and operational disruption in embedded, server, and Android-derived environments.

How an attack unfolds

An attacker or local process triggers DMA channel allocation and transfer completion paths that cause axi_desc_put() to walk beyond the hw_desc array bounds; the additional removal of the unbalanced axi_chan_start_first_queued() call after transfer completion prevents further descriptor-state corruption. No widespread in-the-wild exploitation is recorded, though listed threat actors have targeted similar Linux kernel DMA and resource-handling flaws in 2024 campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit 7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5 or later; rebuild and deploy the updated kernel image, then reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5, verify the axi_dma_desc structure now stores allocated_hw_descs, and test DMA workloads that previously triggered the overrun.

Typical attack path

1. Identify or control a process that can allocate DMA buffers with high segment counts on an affected AXI DMA channel
2. Trigger descriptor allocation resulting in descs_allocated > hw_desc array size
3. Initiate transfer completion so axi_desc_put() iterates using the oversized descs_allocated value
4. Cause out-of-bounds write or read leading to kernel panic or memory corruption

How to detect it

Search kernel logs (dmesg, syslog, journalctl) for panic messages referencing dw-axi-dmac, axi_desc_put, or hw_desc array bounds; correlate with processes performing DMA allocations on AXI channels. Monitor for sudden reboots on systems exposing the driver.

What your security team should do

• Apply the fixed kernel commit or distribution update within the next maintenance window given the 823-day publication age and low but non-zero EPSS
• Prioritize systems that use the dw-axi-dmac driver (embedded, SoC, Android kernels)
• Add kernel panic and DMA-related log monitoring to existing detection rules
• Review downstream package dependents for any delayed updates